redline | ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a

Analysis

max time kernel
290s
max time network
297s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27/03/2023, 22:17

Target

ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe
Size

292KB
MD5

65a08ffc4bdb323b6899ae9737f747f6
SHA1

6a7fa5c964ab7548ce8492d3374bc346dbf13839
SHA256

ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a
SHA512

ea5443621fdc13634b0503aa830eba4a6c612ce772da25f005e14e9e6671324b1a0b0f026c136ffc1a04e11028646245d6d28b3d171c06416af0d66fba544b40
SSDEEP

6144:JZ5UN3ALaT+qAvDwgCzJ5vIwjs5WIQuqg:JXUN3ALaxAaLjAQ

Score

10^/10

Family

redline

135.181.173.163:4323

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2476 set thread context of 2984	2476	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	2476	WerFault.exe	65

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2984	2476	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	67
PID 2476 wrote to memory of 2984	2476	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	67
PID 2476 wrote to memory of 2984	2476	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	67
PID 2476 wrote to memory of 2984	2476	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	67
PID 2476 wrote to memory of 2984	2476	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	67

C:\Users\Admin\AppData\Local\Temp\ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe
"C:\Users\Admin\AppData\Local\Temp\ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 508
  2⤵
  - Program crash
  PID:1564

memory/2984-121-0x0000000000750000-0x0000000000782000-memory.dmp

Filesize
200KB

Download
memory/2984-129-0x0000000009150000-0x0000000009756000-memory.dmp

Filesize
6.0MB

Download
memory/2984-130-0x0000000008CE0000-0x0000000008DEA000-memory.dmp

Filesize
1.0MB

Download
memory/2984-131-0x0000000008C10000-0x0000000008C22000-memory.dmp

Filesize
72KB

Download
memory/2984-132-0x0000000008C70000-0x0000000008CAE000-memory.dmp

Filesize
248KB

Download
memory/2984-133-0x0000000008DF0000-0x0000000008E3B000-memory.dmp

Filesize
300KB

Download
memory/2984-134-0x0000000008F80000-0x0000000008F90000-memory.dmp

Filesize
64KB

Download
memory/2984-139-0x0000000008F80000-0x0000000008F90000-memory.dmp

Filesize
64KB

Download